Unauthenticated SQL Injection In Channel Software WebAlliance eCommerce
Overview While performing continuous red teaming exercises through Rapid7’s Vector Command service, Rapid7 discovered CVE-2026-108065 , an SQL Injection vulnerability (CWE-89) in Channel Software WebAlliance eCommerce.The exploit allows a malicious actor to read sensitive data from the database, or, if the database user has high privileges, run system commands on the database server.
Summary from Rapid7 Blog.
Vulnerabilities in this story
Severity and exploitation facts from NVD, FIRST, and CISA.